Keenan: Is your wallet leaking your health data?

First, the good news. Canada has pretty strong privacy laws, so you can be confident that your medical history, diagnoses, and prescriptions are not being sold or misused, at least not legally. This means you can relax when you go to the drugstore to collect your meds. But while you’re there, say you pick up [...]

First, the good news. Canada has pretty strong privacy laws, so you can be confident that your medical history, diagnoses, and prescriptions are not being sold or misused, at least not legally. This means you can relax when you go to the drugstore to collect your meds.

But while you’re there, say you pick up a bottle of saw palmetto. It’s an herbal remedy advertised as “helping to relieve the urologic symptoms associated with mild to moderate BPH.” That’s benign prostatic hyperplasia; the very common enlargement of the prostate gland that happens as a man ages.

Its symptoms include having to go to the bathroom way too often, particularly in the middle of the night. Being frugal, you swipe your loyalty card. Might as well get the points, right?

That simple move can expose you to a whole ecosystem of something called health-adjacent data. Under Canadian privacy laws, the purchase of a supplement is not considered protected health information. Instead, it is commercial data that can be bought and sold.

By contrast, if you decided to reduce your nocturnal bathroom trips with a prescription medication like Tamsulosin (Flomax) or Finasteride (Proscar), that purchase would have been protected health information. Now that your pharmacy knows you are interested in BPH, it can sell that information to a data broker or an advertising platform such as Meta, Google or Amazon. Confirmation that they actually do this can be found in the published privacy policies of many companies, including Loblaws/Shoppers Drug Mart.

To be able to claim they haven’t given out your personal details, fields like your loyalty ID and email address are “hashed” by the pharmacy, so they’re not directly readable. They look like a string of random characters. However, this only gives the illusion of privacy.

Pretty much everyone uses the same hashing technique, SHA-256. Having obtained your hashed data, the advertising platform just runs that same algorithm on its copy of your email address and then looks for a match with what it received from the pharmacy. Now it knows exactly who you are and can target you with ads.

Data brokers sell groups of potential customers in categories like “aging men”, “sport nutrition buyers”, “sleep aid purchasers” and “ED concerns.” You have almost certainly been swept up in one or more of these groups, which may explain why you see uncannily appropriate ads when you’re just trying to do a Google search or check Facebook. Because U.S. and Canadian privacy laws differ so much, it’s interesting to see which companies process loyalty data in the U.S.

The simple answer is — all of them. The privacy policies of Loblaws/Shoppers Drug Mart, Sobeys/Safeway/Scene+ and Canadian Tire/Triangle Rewards all contain some version of “Your information may be processed in other countries.” Another worrisome difference between U.S. and Canadian privacy laws is that in the U.S., it’s legal to sell health-adjacent data to insurance companies and employers.

The implications, from increased premiums to denial of insurance or employment, could be life-changing. Besides, the accuracy of this data can be questionable. A young guy who regularly buys saw palmetto for his grandfather but uses his own loyalty card is likely to get swept up into the BPH category.

If you want to minimize this type of targeting, it might be wise to forgo loyalty points on certain purchases or to use a separate card for them, tied to a bogus email address. I have often used x@y.com when I know I’ll never want to receive email from a site. If you do need an email for a signup, there are plenty of services that provide free disposable email addresses for one-time use.

Even if you take all these precautions, sooner or later, you will probably use a U.S.-based site to research health questions. Just doing this could get you added to one of those interest groups. Here, you want to take precautions such as using a VPN (Virtual Private Network) to mask your IP address and, of course, never reveal personal information or email addresses.

The biggest leaker of your health data may be on your wrist. Your smartwatch or fitness tracker knows a lot about your health status and lifestyle. In the U.S., wearable data is a commercial commodity that can be bought and sold.

Once the data crosses the border, U.S. laws apply, and U.S. data brokers like LiveRamp, Acxiom, Oracle, and Experian can gobble it up. If you want to stay out of their clutches, the advice is to set up a dedicated email for your tracker account that has no link to your personal information. Having extra email addresses may seem like a lot of work just to protect you from a few targeted ads.

However, cybersecurity experts warn that you never know what future search technologies, AI, and legal changes may bring. The time to protect your privacy, they say, is now. Tom Keenan is an award-winning journalist, public speaker, professor in the School of Architecture, Planning and Landscape at the University of Calgary, and